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ABSTRACT 



We show that three fundamental information-theoretic constraints — the 
impossibility of superluminal information transfer between two physical 
systems by performing measurements on one of them, the impossibility of 
broadcasting the information contained in an unknown physical state, and 
the impossibility of unconditionally secure bit commitment — suffice to en- 
tail that the observables and state space of a physical theory are quantum- 
mechanical. We demonstrate the converse derivation in part, and consider 
the implications of alternative answers to a remaining open question about 
nonlocality and bit commitment. 
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Of John Wheeler's 'Really Big Qüestions', the one on which most progress has been made is It from Bit? — 
does information play a significant role at the foundations of physics? It is perhaps less ambitious than some 
of the other Qüestions, such as How Come Existence? \ because it does not necessarily require a metaphysical 
answer. And unlike, say, Why the Quantum?, it does not require the discovery of new laws of nature: there 
was room for hope that it might be answered through a better understanding of the laws as we currently know 
them, particularly those of quantum physics. And this is what has happened: the better understanding is the 
quantum theory of information and computation. 

How might our conception of the quantum physical world have been different if It From Bit had been a 
motivation from the outset? No one knows how to derive it (the nature of the physical world) from bit (the 
idea that information plays a significant role at the foundations of physics), and I shall argue that this will 
never be possible. But we can do the next best thing: we can start from the qubit. 

Intwduction to David Deutsch 's (2003) 'It From Qubit' 

1 Introduction 

Towards the end of the passage above, Deutsch is pessimistic about the prospects of 
deducing the nature of the quantum world from the idea that information plays a sig- 
nificant role at the foundations of physics. We propose to counter Deutsch's pessimism 
by beginning with the assumption that we live in a world in which there are certain 
constraints on the acquisition, representation, and communication of information, and 
then deducing from these assumptions the bàsic outlines of the quantum-theoretic de- 
scription of physical systems. 1 

The three fundamental information-theoretic constraints we shall be interested in 

are: 

• the impossibility of superluminal information transfer between two physical sys- 
tems by performing measurements on one of them; 

• the impossibility of perfectly broadcasting the information contained in an un- 
known physical state; and 

• the impossibility of unconditionally secure bit commitment. 

These three 'no-go's' are all well-known consequences of Standard nonrelativistic Hilbert 
space quantum theory. However, like Einstein's radical re-derivation of Lorentz's trans- 
formation based upon privileging a few simple principies, we here propose to raise the 
above constraints to the level of fundamental information-theoretic iaws of nature' 
from which quantum theory can, we claim, be deduced. We shall do this by starting 
with a mathematically abstract characterization of a physical theory that includes, as 
special cases, all classical mechanical theories of both wave and particle varieties, and 
all variations on quantum theory, including quantum field theories (plus any hybrids of 
these theories). Within this framework, we are able to give general formulations of the 
three information-theoretic constraints above, and then show that they jointly entail: 

1 Chris Fuchs and Gilles Brassard first suggested the project to one of us (JB) as a conjecture or speculation 
(Brassard's preferred term) that quantum mechanics can be derived from two cryptographic principies: the 
possibility of secure key distribution and the impossibility of secure bit commitment [23 24 25 7|. 
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• that the algebras of observables pertaining to distinct physical systems must 
commute, usually called microcausality or (a term we prefer) kinematic inde- 
pendence (see Summers |46|); 

• that any individual system's àlgebra of observables must be nonabelian, i.e., non- 
commutative; 

• that the physical world must be nonlocal, in that spacelike separated systems 
must at least sometimes occupy entangled states. 

We shall argue that these latter three physical characteristics are definitive of what it 
means to be a quantum theory in the most general sense. Conversely, we would want 
to prové that these three physical characteristics entail the three information-theoretic 
principies from which we started, thereby providing a characterization theorem for 
quantum theory in terms of those principies. In this, we are only partly successful, 
because there remains an open question about bit commitment. 

The fact that one can characterize quantum theory (modulo the open question) in 
terms of just a few simple information-theoretic principies not only goes some way 
towards answering Wheeler's query ' Why the Quantum?' (without, pace Deutsch, the 
introduction of new laws), but lends credence to the idea that an information-theoretic 
point of view is the right perspective to adopt in relation to quantum theory. Notice, in 
particular, that our derivation links information-theoretic principies directly to the very 
features of quantum theory — noncommutativity and nonlocality — that are so concep- 
tually problemàtic from a purely physical/mechanical point of view. We therefore sug- 
gest substituting for the conceptually problemàtic mechanical perspective on quantum 
theory an information-theoretic perspective. That is, we are suggesting that quantum 
theory be viewed, not as first and foremost a mechanical theory of waves and partides 
(cf. Bohr's infamous dictum, reportedin Petersen |39|: 'There is no quantum world.'), 
but as a theory about the possibilities and impossibilities of information transfer. 

We begin, in section 2, by laying out the mathematical framework within which our 
entire analysis will be conducted — the theory of C*-algebras. After introducing the bà- 
sics, we establish that the C*-algebraic framework does indeed encompass both classi- 
cal and quantum statistical theories, and go on to argue that the latter class of theories 
is most properly viewed as picked out solely in virtue of its satisfaction of kinematic 
independence, noncommutativity, and nonlocality — even though there is far more to 
the physical content of any given quantum theory than these three features. Section 
3 contains our technical results. We first formulate the three information-theoretic 
constraints — no superluminal information transfer via measurement, no broadcasting, 
and nobit commitment — in C*-algebraic terms, after briefly reviewing the concepts 
as they occur in Standard nonrelativistic Hilbert space quantum theory. We show that 
these information-theoretic 'no-go' principies jointly entail kinematic independence, 
noncommutativity, and nonlocality. We demonstrate the converse derivation in part: 
that the physical properties of kinematic independence and noncommutativity jointly 
entail no superluminal information transfer via measurement and no broadcasting. 

The remaining open question concerns the derivation of the impossibility of un- 
conditionally secure bit commitment from kinematic independence, noncommutativ- 
ity, and nonlocality in the theory-neutral C*-algebraic framework. The proof of this 
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result in Standard quantum mechanics (Mayers H37II38I . Lo and Chau 1351 ) depends 
on the biorthogonal decomposition theorem, which is not available in the more gen- 
eral framework. If the derivation goes through, then we have a characterization theo- 
rem for quantum theory in terms of the three information-theoretic principies, thereby 
considerably generalizing the known proofs of these principies within the Standard 
nonrelativistic Hilbert space quantum theory framework. If not, then there must be 
quantum mechanical systems — perhaps systems associated with von Neumann alge- 
bras of some nonstandard type — that allow an unconditionally secure bit commitment 
protocol! Section 4 concludes with some further remarks about the significance of our 
information-theoretic characterization of quantum theory. 

2 The C*-Algebraic Approach to Physical Theory 

2.1 Basic Concepts 

We start with a brief review of abstract C*-algebras and their relation to the Standard 
formulation of quantum theory in terms of concrete algebras of operators acting on a 
Hilbert space. 

A unital C* -àlgebra is a Banach * -àlgebra over C containing the identity, where 
the involution and norm are related by = \\A\\ 2 . Thus, the àlgebra 03 (7í) of 

all bounded operators on a Hilbert space fí — which, of course, is used in the Standard 
formulation of nonrelativistic quantum theory — is an example of a C* -àlgebra, with * 
taken to be the adjoint operation, and || • || the Standard operator norm. Moreover, any 
*-™Z?algebra of 03 (7í) containing the identity operator that is closed in the operator 
norm is a (unital) C* -àlgebra. By a representation of a C* -àlgebra 21 is meant any 
mapping 7r : 21 — > 03 (fí) that preserves the linear, product, and * structure of 21. If, in 
addition, ix is one-to-one (equivalently, ir(A) = implies A = 0), the representation 
is called faithful. In a faithful representation, 7r(2l) provides an isomorphic copy of 
21. A representation is irreducible just in case the only closed subspaces of fí that are 
invariant under ir are fí and the null space. 

A von Neumann àlgebra TZ is a concrete collection of operators on some fixed 
Hilbert space fí — specifically, a *-subalgebra of 03 (fí) that contains the identity and 
satisfies TZ = TZ". (Here TZ" is the double commutant of TZ, where the commutant 
TZ' is the set of all operators on fí that commute with every operator in TZ). This is 
equivalent, via von Neumann's double commutant theorem (|30 Theorem 5.3.1]), to 
the assertion that TZ contains the identity and is closed in the strong operator topology 
(where Z n — > Z strongly just in case \\(Z n — Z)x\\ — » for all x Efí, and the norm 
here is the Hilbert space vector norm). 

Every von Neumann àlgebra is also a C* -àlgebra, but not every C* -àlgebra of 
operators is a von Neumann àlgebra. A von Neumann àlgebra TZ is termed a factor just 
in case its center TZílTZ' contains only múltiples of the identity. This is equivalent to the 
condition (TZ U TZ')" = 03(7i), so TZ induces a 'factorization' of the total Hilbert space 
àlgebra 03 (fí) into two subalgebras which together generate that àlgebra. Factors are 
classified into different types. The àlgebra 03 (fí) for any Hilbert space fí is a type I 
factor, and every type I factor arises as the àlgebra of all bounded operators on some 
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Hilbert space 1 30 Theorem 6.6.1]. Type II and type III factors, and subclassifications, 
have applications to the thermodynamic limit of quantum statistical mechanics and 
quantum field theory. 

A state of a C* -àlgebra 21 is taken to be any positive, normalized, linear functional 
p : 21 — > C on the àlgebra. For example, a state oï ç &{7i) in Standard quantum theory is 
obtained if we select a positive trace-one (density) operator D on Tí, and define p(A) = 
Ti(AD) for all A £ Q3(W), which defines a linear functional that is positive (if A = 
X*X, then Tt(X*XD) = Tr(XDX*), and the latter is nonnegative because XDX* 
is a positive operator), normalized (since Ti(ID) = 1), and linear (since operator 
composition and the trace operation are both linear). We can make the usual distinction 
between pure and mixed states, the former defined by the property that if p = Xpi + 
(1 — X)p2, with À G (0, 1), then p = p\ = p2- In the concrete case of Q5(7i), a 
pure state of course corresponds to a density operator for which D 2 = D — which is 
equivalent to the existence of a unit vector \v) G Tí representing the state of the system 
via p(A) = (v\A\v) (A e <&{H)). 

One should note, however, that, because countable additivity is not presupposed by 
the C*-algebraic notion of state (and, therefore, Gleason's theorem does not apply), 
there can be pure states of Q5(7i) not representable by vectors in Tí. In fact, if A is 
any self-adjoint element of a C*-algebra 21, and a G sp(A), then there always exists a 
pure state p of 21 that assigns a dispersion-free value of a to A 1301 Ex. 4.6.31]. Since 
this is true even when we consider a point in the continuous spectrum of a self-adjoint 
operator A acting on a Hilbert space, without any corresponding eigenvector, it follows 
that there are pure states of Q3(7i) in the C*-algebraic sense that cannot be vector states 
(nor, in fact, representable by any density operator Tí). 

The primary reason countable additivity is not required of C*-algebraic states is 
that it is a representation-dependent concept that presupposes the availability of the 
notion of an infinite convergent sum of orthogonal projections. That is: to say that a 
state p is countably additive is to say that Pi = I implies p{Pi) = 1; yet 

the notion of convergence required for the first sum to make sense is strong operator 
convergence (where a sequence of operators Ai converges strongly to some operator A 
just in case, for all x G Tí, Aix — > Ax in vector norm). Since, obviously, the elements 
of a C* -àlgebra 21 need not be thought of as operators acting on a Hilbert space of 
vectors, countable additivity is simply unavailable as a potential general constraint that 
could be imposed on the state space of 21. 

Nevertheless, it turns out that for any state p of a C*-algebra 21, there is always 
some representation of 21 in which p is representable by a vector (even if p is a mixed 
state). According to the Gelfand-Naimark-Segal theorem OÜI Thm. 4.5.2], every state 
p determines a unique (up to unitary equivalence) representation (ir p ,Tí p ) of 21 and 
vector íl p G Tí p such that p(A) = (íï p ,ir p (A)íï p ) (A G 21), and such that the set 
{n p (A)ü p : A G 21} is dense in Tí p . The triple (ir p ,Tí p ,tt p ) is called the GNS 
representation of 21 induced by the state p, and this representation is irreducible if and 
only if p is pure (equivalently, every bounded operator on H p is the strong limit of 
operators in 7r p (2l)). 

Now, by considering the collection of all pure states on 21, and forming the di- 
rect sum of all the irreducible GNS representations these states determine, one obtains 
a highly reducible but faithful representation of 21 in which every pure state of 21 is 
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represented by a vector (as usual in Standard nonrelativistic quantum theory). As a 
consequence of this construction, we obtain the Gelfand-Naimark theorem: every ab- 
stract C* -àlgebra has a concrete faithful representation as a norm-closed *-subalgebra 
of 23(7i), for some appropriate Hilbert space H 1301 Remark 4.5.7]. So there is a 
sense in which C*-algebras are no more general than algebras of operators on Hilbert 
spaces — apart from the fact that, when working with an abstract C* -àlgebra, one does 
not privilege any particular concrete Hilbert space representation of the àlgebra (which 
turns out to be important not to do in quantum field theory, where one needs to allow for 
inequivalent representations of the canonical commutation relations — see, e.g., Clifton 
and Halvorson 1 12 1). 

2.2 Physical Generality of the C*-Algebraic Language 

If C* -algebras supply little more than a way of talking abstractly about operator alge- 
bras, and the latter are characteristic of quantum theory, how can we possibly claim 
that the C*-algebraic machinery supplies a universal language within which all main- 
line physical theories, including even classical mechanics, can be framed? The fallacy, 
here, is that the use of operator algebras is only relevant to quantum theories. 

Take, as a simple example, the classical description of a system of n point parti- 
des. Focusing first on the kinematical content of the theory, the observables of the 
system are real-valued functions on its phase space R 6n . These can be thought of as 
the self-adjoint elements of the C* -àlgebra 23 (R 6 ™) of all bounded, complex-valued 
measurable functions on R 6ra — where the multiplication law is just pointwise multi- 
plication of functions, the adjoint is complex conjugation, and the norm of a function 
is the supremum of its absolute vàlues. The statistical states of the system are given 
by probability measures fi on R 6n , and pure states, corresponding to maximally com- 
plete information about the partides, are given by the individual points of R 6n . Using 
a statistical state /i, we obtain the corresponding expectation functional, which is the 
system's state in the C*-algebraic sense, by defining p(f) = L 6n /d/i (/ e 23(R 6 ")). 

Turning now to dynamics, the Heisenberg picture of the time evolution of a state 
is determined by a group of bijective, Lebesgue measure-preserving, fiow mappings 
T t : R 6n -> R 6n (í e R) that induce an automorphism group r t on 23(R 6n ) via 
T t(f) — f °Tt- State evolution when a measurement occurs is also fully analogous 
to the quantum case. The probability in state /i that the value of / will be found on 
measurement to lie in a Borel set A is given by p(Xf- 1 (A)) (note that Xf- 1 (A) is a 
projection in 23 (R 6 ™)); and, should that be the case, the new post-measurement state is 
given by (see Bona [2000] and Duvenhage [2002a,b]): 

p'(g) = ^/-i(A)gX/-i(A)) {g g R6n) 

P(X/- 1 (A)) 

Lastly, note that because classical n point particle mechanics employs a C*-algebra 
(as we have seen, 23 (R 6 ")), it follows from the Gelfand-Naimark theorem that classical 
mechanics can be done in Hilbert space! Yet this really is nothing new, having been 
pointed out long ago by Koopman [ 3 1 1 and von Neumann [47 1 (see Mauro [ 36 1 for an 
up-to-date discussion). 
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Of course, nothing we have said proves that all physical theories admit a C*- 
algebraic formulation. Indeed, that would be absurd to claim: one can certainly con- 
ceive of theories whose àlgebra of observables falls short of being isomorphic to the 
self-adjoint part of a C* -àlgebra and, instead, only instantiates some weaker math- 
ematical structure, such as a Segal |45| àlgebra. To foreclose such possibilities, it 
could be of interest to pursue an axiomàtic justification of the C*-algebraic framework 
along lines similar to those provided by Emch GTl Ch. 1.2]. However, it suffices for 
present purposes simply to observe that all physical theories that have been found em- 
pirically successful — not just phase space and Hilbert space theories (Landsman [ 34 1), 
but also theories based a manifold (Connes 1131 ) — fall under this framework (whereas, 
for example, so-called 'nondistributive' Segal algebras permit violations of the Bell 
inequality far in excess of that permitted by Standard quantum theory and observed in 
the laboratory — see Landau [33 1). 

2.3 Classical versus Quantum Theories 

We must mention one final important representation theorem: every (unital) abelian 
C*-algebra 21 is isomorphic to the set C(X) of all continuous, complex-valued func- 
tions on a compact Hausdorff space X 1301 Thm. 4.4.3]. This is called the function rep- 
resentation of 21. The underlying 'phase space' X in this representation is none other 
than the pure state space "P(2l) of 21 endowed with its weak-* topology. (A sequence 
of states {p n } on 21 weak-* converges to a state p just in case p n (A) — > p(A) for all 
A S 21.) The isomorphism maps an element A e 21 to the function A (the Gelfand 
transformation of A) whose value at any p 6 "P(2l) is just the (dispersion-free) value 
that p assigns to A. Thus, not only does every classical phase space presentation of 
a physical theory define a C* -àlgebra, but, conversely, behind every abstract abelian 
C* -àlgebra lurks in its function representation a good old-fashioned classical phase 
space theory. All of this justifies treating a theory formulated in C*-algebraic language 
as classical just in case its àlgebra is abelian. It follows that a necessary condition for 
thinking of a theory as a quantum theory is that its C*-algebra be non-abelian. How- 
ever, as we shall now explain, we do not believe this is sufficient unless something 
further is said about the presence of entangled states. 

In 1935 and 1936, Schròdinger published an extended two-part commentary [43 
1441 on the Einstein-Podolsky-Rosen argument [19], where he introduced the term 'en- 
tanglement' to describe the peculiar correlations of the EPR-state as 1431 p. 555]: 
'the characteristic trait of quantum mechanics, the one that enforces its entire depar- 
ture from classical lines of thought.' In the first part, he considers entangled states for 
which the biorthogonal decomposition is unique, as well as cases like the EPR-state, 
where the biorthogonal decomposition is non-unique. There he is concerned to show 
that suitable measurements on one system can fix the (pure) state of the entangled dis- 
tant system, and that this state depends on what observable one chooses to measure, 
not merely on the outcome of that measurement. In the second part, he shows that a 
'sophisticated experimenter,' by performing a suitable local measurement on one sys- 
tem, can 'steer' the distant system into any mixture of pure states representable by its 
reduced density operator. (So the distant system can be steered into any pure state in 
the support of the reduced density operator, with a nonzero probability that depends 
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only on the pure state.) For a mixture of linearly independent states, the steering can 
be done by performing a PV-measurement in a suitable basis. If the states are lin- 
early dependent, the experimenter performs a POV-measurement, which amounts to 
enlarging the experimenter's Hilbert space by adding an ancilla, so that the dimension 
of the enlarged Hilbert space is equal to the number of linearly independent states. 
Schròdinger's result here anticipates the later result by Hughston, Jozsa, and Wootters 
1 28 1 that underlies the 'no go' bit commitment theorem. (Similar results were proved 
by Jaynes |29| and Gisin |27|.) 

What Schròdinger found problemàtic — indeed, objectionable — about entanglement 
was this possibility of remote steering |43 p. 556]: 

It is rather discomforting that the theory should allow a system to be 
steered or piloted into one or the other type of state at the experimenter's 
mercy in spite of his having no access to it. 

He conjectured that an entangled state of a composite system would almost instan- 
taneously decay to a mixture as the component systems separated. (A similar possibil- 
ity was raised and rejected by Furry |26|.) There would still be correlations between 
the states of the component systems, but remote steering would no longer be possible 



It seems worth noticing that the [EPR] paradox could be avoided by a very 
simple assumption, namely if the situation after separating were described 
by the expansion (12), but with the additional statement that the knowledge 
of the phase relations between the complex constants au has been entirely 
lost in consequence of the process of separation. This would mean that not 
only the parts, but the whole system, would be in the situation of a mixture, 
not of a pure state. It would not preclude the possibility of determining the 
state of the first system by suitable measurements in the second one or 
vice versa. But it would utterly eliminate the experimenters influence on 
the state of that system which he does not touch. 

Expansion (12) is the biorthogonal expansion: 



Schròdinger regarded the phenomenon of interference associated with noncommu- 
tativity in quantum mechanics as unproblematic, because he saw this as reflecting the 
fact that partides are wavelike. But he did not believe that we live in a world in which 
physical systems can exist nonlocally in entangled states, because such states would al- 
low Alice to steer Bob's system into any mixture of pure states compatible with Bob's 
reduced density operator. Schròdinger did not expect that experiments would bear this 
out. On his view, entangled states, which the theory allows, are entirely local insofar as 
they characterize physical systems, and nonlocal entangled states are simply an artefact 
of the formalism. 

Of course, it was an experimental question in 1935 whether Schròdinger's conjec- 
ture was correct or not. We now know that the conjecture is false. A wealth of experi- 
mental evidence, including the experimentally confirmed violations of Bell's inequality 
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(e.g., Aspect et al | 1 1), testify to this. The relevance of Schròdinger's conjecture for 
our inquiry is this: it raises the possibility of a quantum-like world in which there is 
interference but no nonlocal entanglement. We will need to exclude this possibility on 
information-theoretic grounds. 

As indicated, for a composite system, A+B, consisting of two component subsys- 
tems, A and B, we propose to show (i) that the 'no superluminal information transfer 
via measurement' condition entails that the C*-algebras 21 and 03, whose self-adjoint 
elements represent the observables of A and B, commute with each other, and (ii) that 
the 'no broadcasting' condition entails that 21 and 03 separately are noncommutative 
(nonabelian). Now, if 21 and 03 are nonabelian and mutually commuting (and C*- 
independent 2 ), it follows immediately that there are nonlocal entangled states on the 
C* -àlgebra 21 V 23 they generate (see Landau 1 32 1, who shows that there is a state p on 
21 V 03 that violates Bell's inequality and hence is nonlocally entangled; also Summers 
and Werner |46| and Bacciagaluppi |3|). So, at least mathematically, the presence 
of nonlocal entangled states in the formalism is guaranteed, once we know that the 
algebras of observables are nonabelian. What does not follow is that these states ac- 
tually occur in nature. For example, even though Hilbert space quantum mechanics 
allows for paraparticle states, such states are not observed in nature. In terms of our 
program, in order to show that entangled states are actually instantiated, and — contra 
Schròdinger — instantiated nonlocally, we need to derive this from some information- 
theoretic principle. This is the role of the 'no bit commitment' constraint. 

Bit commitment is a cryptographic protocol in which one party, Alice, supplies an 
encoded bit to a second party, Bob. The information available in the encoding should 
be insufficient for Bob to ascertain the value of the bit, but sufficient, together with 
further information supplied by Alice at a subsequent stage when she is supposed to 
reveal the value of the bit, for Bob to be convinced that the protocol does not allow 
Alice to cheat by encoding the bit in a way that leaves her free to reveal either or 1 at 
will. 

In 1984, Bennett and Brassard |5| proposed a quantum bit commitment protocol 
now referred to as BB84. The bàsic idea was to associate the and 1 commitments 
with two equivalent quantum mechanical mixtures represented by the same density 
operator. As they showed, Alice can cheat by adopting an Einstein-Podolsky-Rosen 
(EPR) attack or cheating strategy: she prepares entangled pairs of partides, keeps one 
of each pair (the ancilla) and sends the second particle (the channel particle) to Bob. In 
this way she can fake sending one of two equivalent mixtures to Bob, and reveal either 
bit at will at the opening stage, by effectively steering Bob's partides into the desired 
mixture via appropriate measurements on her ancillas. Bob cannot detect this cheating 
strategy. 

Mayers 1371 1381 . and Lo and Chau 1351 . showed that the insight of Bennett and 
Brassard can be extended to a proof that a generalized version of the EPR cheating strat- 
egy can always be applied, if the Hilbert space is enlarged in a suitable way by intro- 
ducing additional ancilla partides. The proof of the 'no go' quantum bit commitment 
theorem exploits biorthogonal decomposition via the Hughston-Jozsa-Wootters result 
|28| (effectively anticipated by Schròdinger). Informally, this says that for a quantum 

2 See section 3.1. 
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mechanical system consisting of two (separated) subsystems represented by the ten- 
sor product of two type-I factors Q3(7íi) ® 23(7^2), any mixture of states on 53 (W2) 
can be generated from a distance by performing an appropriate POV-measurement on 
the system represented by 53 (Wi), for an appropriate entangled state of the composite 
system 53(7ii) <g> 53(7^2)- This is what makes it possible for Alice to cheat in her bit 
commitment protocol with Bob. It is easy enough to see this for the original BB84 pro- 
tocol. Suprisingly, this is also the case for any conceivable quantum bit commitment 
protocol. (See Bub |9 1 for a discussion.) 

Now, unconditionally secure bit commitment is impossible for classical systems, in 
which the algebras of observables are abelian. It might seem inappropriate, then, that 
we propose 'no bit commitment' as a constraint distinguishing quantum from classical 
theories. The relevant point to note here is that the insecurity of any bit commitment 
protocol in a nonabelian setting depends on considerations entirely different from those 
in a classical abelian setting. Classically, unconditionally secure bit commitment is 
impossible, essentially because Alice can send (encrypted) information to Bob that 
guarantees the truth of an exclusive classical disjunction (equivalent to her commitment 
to a or a 1) only if the information is biased towards one of the alternative disjuncts 
(because a classical exclusive disjunction is true if and only if one of the disjuncts 
is true and the other false). No principle of classical mechanics precludes Bob from 
extracting this information. So the security of the protocol cannot be unconditional and 
can only depend on issues of computational complexity. 

By contrast, in a situation of the sort envisaged by Schròdinger, in which the al- 
gebras of observables are nonabelian but composite physical systems cannot exist in 
nonlocal entangled states, if Alice sends Bob one of two mixtures associated with the 
same density operator to establish her commitment, then she is, in effect, sending Bob 
evidence for the truth of an exclusive disjunction that is not based on the selection of 
a particular disjunct. (Bob's reduced density operator is associated ambiguously with 
both mixtures, and hence with the truth of the exclusive disjunction: '0 or 1'.) This 
is what noncommutativity allows: different mixtures can be associated with the same 
density operator. What thwarts the possibility of using the ambiguity of mixtures in 
this way to implement an unconditionally secure bit commitment protocol is the exis- 
tence of nonlocal entangled states between Alice and Bob. This allows Alice to cheat 
by preparing a suitable entangled state instead of one of the mixtures, where the re- 
duced density operator for Bob is the same as that of the mixture. Alice is then able 
to steer Bob's systems into either of the two mixtures associated with the alternative 
commitments at will. 

So what would allow unconditionally secure bit commitment in a nonabelian theory 
is the absence of physically occupied nonlocal entangled states. One can therefore 
take Schròdinger's remarks as relevant to the question of whether or not secure bit 
commitment is possible in our world. In effect, Schròdinger believes that we live in a 
quantum-like world in which secure bit commitment is possible. Experiments such as 
those designed to test Bell's inequality can be understood as demonstrating that this is 
not the case. The violation of Bell's inequalities can then be seen as a criterion for the 
possibility of remote steering in Schròdinger's sense. 
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3 Technical Results 



3.1 Terminology and Assumptions 

Our aim in this section is to show that the kinematic aspects of the quantum theory of 
a composite system A+B (consisting of two component subsystems A and B) can be 
characterized in terms of information-theoretic constraints. The physical observables 
of A and B are represented, respectively, by self-adjoint elements of unital subalgebras 
21 and 05 of a C*-algebra C. We let 21V05 denote the C*-algebra generated by 21 and 05. 
A state of A, B, or A+B (i.e., a catalog of the expectation vàlues of all observables) can 
be represented by means of a positive, normalized, linear functional on the respective 
àlgebra of observables. Recali that a state p is said to be pure just in case p = Xpi + 
(1 — X)p2, for A 6 (0, 1), entails that p = p\ = p2', otherwise, p is said to be mixed. 
For simplicity, we will assume that the systems A and B are identically constituted — 
i.e., they have precisely the same degrees of freedom — and therefore that there is an 
isomorphism between the algebras 21 and 05. (However, it will be clear that most of 
our results do not depend on this assumption.) We will hold this isomorphism fixed 
throughout our discussion so that we can use the same notation to denote ambiguously 
an operator in 21 and its counterpart in 05. We will also use the same notation for a state 
of 21 and its counterpart in the state space of 25. 

The most general dynamical evolution of a system is represented by a completely 
positive, linear 'operation' mapping T of the corresponding àlgebra of observables. 
(We also require that T(I) < I. The operation T is said to be selective if T(I) < I, 
and nonselective if T{I) — I.) Recali that a linear mapping T of 21 is positive just 
in case A > entails T(A) > 0, and is completely positive just in case, for each 
positive integer n, the mapping T (g> l of 2t (8> M„(C) into itself, defined by (T ® 
l)(A®B) = T(A) (gi B, is positive. (Here M n (C) is the C*-algebraof n x n matrices 
over the complex numbers.) If T is an operation of 21, and p is a state of 21 such that 
p{T(I)) ^ 0, then the mapping T*p defined by 

(T* P )(A) = (Ag21) (2) 

is a state of 21. The Standard example of a selective operation is a collapsing von 
Neumann measurement of some observable O with spectral projection P. In that case, 
T(A) = PAP (A G 21), and T*p is the final state obtained after measuring O in state 
p and ignoring all elements of the ensemble that do not yield as measurement result the 
eigenvalue of O corresponding to P. The Standard example of a nonselective operation 
is a time evolution induced by a unitary operator U G 21, where T(A) = U* AU 
( A E 21) simply represents the Heisenberg picture of such evolution. 

Finally, we must add one nontrivial independence assumption in order to capture 
the idea that A and B are physically distinct systems. (Our current assumptions would 
allow that 21 = 05, which obviously fails to capture the situation we are intending to 
describe.) Various notions of independence for a pair 21, 05 of C* -algebras have been 
developed in the literature 1221 1461 . We are particularly interested in the notion of 
C* -independence developed in |22|, because it does not presuppose that 21 and 05 are 
kinematically independent (i.e., that [^4, B] = for all A G 21 and B G 05). Thus, we 
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will assume that — whether or not 21 and 03 are kinematically independent — any state 
of 21 is compatible with any state of 05. More precisely, for any state p\ of 21, and for 
any state p2 of 03, there is a state p of 21 V 03 such that p\™ — p\ and p\çg = p^. This 
condition holds (i.e., 21 and 03 are C* -independent) if and only if || AB|| = \\A\\ |£?||, 
for all A G 21 and B e 03 [22 Prop. 3]. 

3.2 No Superluminal Information Transfer via Measurement and 
Kinematic Independence 

We first show that 21 and 03 are kinematically independent if and only if the 'no su- 
perluminal information transfer via measurement' constraint holds. The sense of this 
constraint is that when Alice and Bob perform local measurements, Alice's measure- 
ments can have no infiuence on the statistics for the outcomes of Bob's measurements 
(and vice versa); for, otherwise, measurement would allow the instantaneous transfer 
of information between Alice and Bob. That is, the mere performance of a local mea- 
surement (in the nonselective sense) cannot, in and of itself, transfer information to a 
physically distinct system. 

The most general nonselective measurement operation performable by Alice is 
given by 

n 

T(A) = J2 E l /2AE l /2 (Ae2ÍV03) (3) 

2=1 

where the Ei are positive operators in 21 such that Y17=i e í — !■ The restriction to 
nonselective measurements is justified here because selective operations can trivially 
change the statistics of observables measured at a distance, simply in virtue of the fact 
that the ensemble relative to which one computes statistics has changed. 

We will say that an operation T conveys no information to Bob just in case T* 
leaves the state of Bob's system invariant (so that everything 'looks the same' to Bob 
after the operation as before, in terms of his expectation vàlues for the outcomes of 
measurements on observables). 

Definí tion. An operation T on 21 V 03 conveys no information to Bob just in case 
(T*p)\çq = p|sg for all states p of 03. 

Note that each C* -àlgebra has sufficient states to discriminate between any two ob- 
servables (i.e., if p(A) — p(B) for all states p, then A — B). Now (T*p)\çg = p\çg 
iff p{T(B)) = p(B) for all B G 03 and for all states p of 21 V 03. Since all states of 
03 are restrictions of states on 21 V 03, it follows that (T*p)\ço = p\çg if and only if 
lü{T{B)) = lü(B) for all states lü of 03, i.e., if and only if T(B) = B for all B e 03. 

It is clear that the kinematic independence of 21 and 03 entails that Alice's local 
measurement operations cannot convey any information to Bob (i.e., T{B) = 
Y^i=i Ej' 2 BEj' 2 — B for B £ 03 if T is implemented by a positive operator valued 
resolution of the identity in 21). Thus, we need only show that if Alice cannot convey 
any information to Bob by performing local measurement operations, then 21 and 03 
are kinematically independent. In the Standard Hilbert space case, our argument would 
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proceed as follows: Consider any ideal (Lüders), non-selective measurement of the 
form 

T(A) = PAP + P)A(I -P) (A e 21 V 03) (4) 

where P is a projection in 21. Then no superluminal information transfer via measure- 
ment entails that for any B 6 03, 

B = T{B) = PBP + (I - P)B(I - P) (5) 

and therefore 

2PBP - PB - BP = (6) 

Multiplying on the left (respectively, right) with P, and using the fact that P 2 = P, 
we then obtain PBP - PB = (respectively, PBP - BP = 0). Subtracting these 
two equations gives [P, B] — 0. Thus, since 21 is spanned by its projections and 
03 is spanned by its self-adjoint operators, it follows that 21 and 03 are kinematically 
independent. 

In the more general C*-algebraic framework, this argument is not available: Since 
the àlgebra 21 does not necessarily contain projection operators, we cannot assume 
that there are any measurement operations of the form given in Eqn. |4] where P is a 
projection. Instead, since C*-algebras are spanned by their effects (positive operators), 
consider the simplest case of a POV measurement defined by 

T E (A) = E 1 / 2 AE 1 / 2 + {I-E) 1 ' 2 A{I~E) 1 / 2 (A e 21 V 03) (7) 

where E is some effect in 21. We will now show that when B is self-adjoint, Te(B) — 
B entails that [E, B] = 0. 

Theorem 1. Te(B) = B for all effects E e 21 and self-adjoint operators B G 03 only 
i/21 and 03 are kinematically independent. 

For the proof of this theorem, recali that a derivation is a linear map such that 

d(AB) = A(dB) + (dA)B. 

Proof. Suppose that Te(B) = B where E is an effect in 21 and B is a self-adjoint 
operator in 03. Then a tedious but elementary calculation shows that 

[£ 1/2 ,[£ 1/2 ,B]] = (8) 

Clearly, the map X i— > i\E x l 2 , X] defines a derivation d of 21 V 03. Moreover, since 
d(dB) — and B is self-adjoint, it follows that i[E x l 2 ,B\ = dB = iïol Ap- 
pendix A]. Thus, [E, B] = 0. Finally, since a C*-algebra is spanned by its effects, if 
T E (B) = B for all effects E e 21 and self-adjoint operators S e 03, then 21 and 03 are 
kinematically independent. □ 

Thus, the kinematic independence of 21 and 03 is equivalent to the 'no superluminal 
information transfer by measurement' constraint. In deriving our subsequent results, 
we assume kinematic independence. 
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3.3 No Broadcasting and Noncommutativity 



In a cloning process, a ready state a of system B, and the state to be cloned p of system 
A, are transformed into two copies of p. Thus, such a process creates no correlations 
between the states of A and B. By contrast, in a more general broadcasting process, a 
ready state a, and the state to be broadcast p are transformed to a new state ui of A+B, 
where the marginal states of ui with respect to both A and B are p. 3 In the context of 
elementary quantum mechanics, neither cloning nor broadcasting is generally possi- 
ble: A pair of pure states can be cloned if and only if they are orthogonal (Wootters 
and Zurek |48|, Dieks 1151 ). and (more generally) an arbitrary pair of states can be 
broadcast if and only if they are represented by mutually commuting density matrices 
(Barnum et al j4|). Thus, one might suspect that in a classical theory (in which all 
operators commute), all states can be broadcast. In this section, we show that this is in- 
deed the case; and, in fact, the ability to broadcast states distinguishes classical systems 
from quantum systems. 

We now introduce a general notion of broadcasting for a pair 21, 03 of kinematically 
independent C*-algebras. But we must first establish the existence and uniqueness of 
product states of 21 V 03. 

A state p of 21 V 03 is said to be a product state just in case p(AB) = p(A)p(B) = 
p{BA) for all A e 21 and B e 23. Since 21 and 23 are both C* -independent and 
kinematically independent, there is an isomorphism 7r from the *-algebra generated by 
21 and 03 onto the algebraic tensor product 21 23 such that ir(AB) — A ® B for 
all A 6 21 and B E 03. We will occasionally omit reference to ir and use A <3 B to 
denote the product of A € 21 and B 6 03. It also follows that ir can be extended to a 
continuous surjection 7r from 21V23 onto the spatial tensor product 21 ® 03 1221 Thm. 1]. 
Since the state space of 21 ® 03 has a natural tensor product structure, we can use the 
mapping W to define product states of 21 V 03. In particular, for each state p of 21 €5 03 
define the state ir* p of 21 V 03 by setting 

(ir*p)(A) = p(ir(A)) (Ae2tV03) (9) 

If u> is a state of 21 and p is a state of 03, then ir* (ui <g> p) is a product state of 21 V 03 
with marginal states ui and p. In fact, the following result shows that tï*(ui <S> p) is the 
unique product state of 21 V 03 with these marginal states. 

Lemma 1. Suppose that 21 and 03 are kinematically independent C* -algebras. Then 
for any state ui of% and for any state p of 23 there is at most one state a of%l V 03 such 
thata(AB) = u)(A)p{B) for all A £ %andB e 03. 

Proof. The set 6 of finite sums of the form X)"=i Aí^í w i tri A S 21 and Bi G 03 is a 
*-algebra containing both 21 and 03. Moreover, 6 is clearly contained in any *-algebra 
that contains both 21 and 03. Thus, 6 is the * -àlgebra generated by 21 and 03. Suppose 
then that a and ai are states of 21 V 03 such that a (AB) = w(A)p(B) = ai (AB) for 
all A € 21 and B 6 03. Then 

Ín \ n / n \ 

Y A i B i) = $>04íM£í) = aïíj^Bi) (10) 
i=\ l i=l \i=l / 

3 We are indebted to Rob Spekkens for clarifying this distinction for us, and for supplying relevant refer- 
ences. 
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for all Ai e 21 and £?,; £ 25. Since 21 V 03 is the closure of S in the norm topology, and 
since states are continuous in the norm topology, <tq = a\ . □ 



When it will not cause confusion, we will henceforth supress reference to the state 
mapping tt*, so that ui ® p denotes the unique product state on 21 V 03 with marginals 
lü and p. 

Definition. Given two isomorphic, kinematically independent C*-algebras 21 and 03, 
we say that a pair {po, pi} of states of 21 can be broadcast just in case there is a Standard 
state a of 03 and a dynamical evolution represented by an operation T of 21 V 03 such 
that T*(p t ® a)\% = T*(p t ® cr)|sg = Pi (i = 0,1). We say that a pair {p ,Pi} of 
states of 21 can be cloned just in case T*(pi ® a) = pi ® pi (i — 0, 1). 

We show next that pairwise broadcasting is always possible in classical systems. 
Indeed, when the algebras of observables are abelian, there is a 'universal' broadcasting 
map that clones any pair of input pure states and broadcasts any pair of input mixed 
states. 

Theorem 2. If 21 and 03 are abelian then there is an operation T on 21 V 03 that 
broadcasts all states ofQL 

Proof. Since 21 is abelian, 21 V 03 is naturally isomorphic to 21 ® 03 |42 Theorem 2]. 
Since 21 and 03 are isomorphic abelian algebras, both are isomorphic to the space 
C(X), where X is some compact Hausdorff space, and therefore 21 <g> 03 = C{X) (g> 
C(X) ^ C(X x X) [30 p. 849]. Define a mapping r\ from X x X into X x X by 
setting 

r]((x,y)) = {x,x) (x,yeX) (11) 

Since i] is continuous, we can define a linear mapping T on C(X x X) by setting 
Tf = for). Since the range of Tf is a subset of the range of /, the mapping T is 
positive, and T(I) = I. Furthermore, every positive mapping whose domain or range 
is an abelian àlgebra is completely positive 1 30 Exercise 11.5.22]. Therefore, T is a 
nonselective operation on C(X) ® C(X). To see that T broadcasts all states, note first 
thatT(/®g) = fg® /for any product function / (g> g. In particular, T(J®/) = /<8>J, 
and thus 

T*(p®a)(I®f) = (p®o)(J®I) = p(f) (12) 

for any states p, a of C(X). That is, T*(p ® cr) | = p. On the other hand, since 
T( f (g> 7) = / <g) I, it follows that 

T*(p®a)(f®I) = (p®a)(/®J) = p(f) (13) 

for any states p, o of C(X). That is, T*(p ® tr)|™ = p. □ 

Barnum ef aZ |4| note that if density operators I?o, í?i on a Hilbert space 7i can 
be simultaneously diagonalized, then there is a unitary operator U that broadcasts the 
corresponding pair of states. Thus, such states can be broadcast by a reversible opera- 
tion, and the added strength of irreversible (general completely positive) operations is 
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not necessary. However, the broadcasting operation T defined in the previous theorem 
is patently irreversible, since it corresponds to a many-to-one mapping (x, y) \— > (x, x) 
of the pure state space. Indeed, although there are many physically significant classi- 
cal systems where broadcasting can be performed via reversible operations, this is not 
generally true. Consider the following two contrasting cases. 

First, in the case of classical particle mechanics, systems A and B each have the 
phase space R 6n , for some finite n. Thus, 21 V 25 ^ C(R 6n ) ® C(M 6n ) S C(M 6n x 
R 6n ), where C(M 6 ") is the set of bounded continuous functions from K 6 ™ into C. Let 
the ready state of system B be the zero vector in M 6n , and let r\ be the invertible linear 
transformation of R 6 ™ x R 6 ™ given by the matrix 



where / is the identity matrix of M 6n . Since r\ is an autohomeomorphismof R 6n x R 6 ™, 
the mapping / i— > for) defines an automorphism of 21 V 25 1 30 Thm. 3.4.3]. Moreover, 
rj((x, 0)) = (x, x) for any pure state x, and an argument similar to that used above 
shows that r} broadcasts arbitrary states. 

Second, suppose that systems A and B each have the phase space N* = N U {oo}, 
where the open sets of N* consist of all finite subsets of N, plus all cofinite sets con- 
taining oo. (That is, N* is the one-point compactification of N.) Then 21 V 25 = 
C(N*) ® C(N*) = C(W x N*), and every automorphism a of 21 V 25 is induced by 
an autohomeomorphism 77 of N* x N* via the equation a{f) = f o r\ | 30 Thm. 3.4.3]. 
However, it is not difficult to see that there is no autohomeomorphism of N* x N* that 
clones arbitary pairs of pure states. In particular, for any n G N*, there is an m 6 N* 
such that (n, m) is not mapped onto (m, m) by any autohomeomorphism of N* x N*. 
Therefore, general classical systems do not permit broadcasting via a reversible opera- 
tion. 

We now show that general quantum systems do not permit broadcasting. In par- 
ticular, we prové that if any two states of a system can be broadcast, then that system 
has an abelian àlgebra of observables. Our proof proceeds by showing that if any two 
states can be broadcast, then any two pure states can be cloned; and that if two pure 
states of a C* -àlgebra can be cloned, then they must be orthogonal. 

Two pure states p, lo of a C*-algebra are said to be orthogonal just in case ||p— cj|| = 
2. More generally, the transition probability p(p, u>) is defined to be (see |41 1): 

p(j>,u>) = l-i||p-c|| 2 (14) 

If p is a state of 21, and U is a unitary operator in 21, then we let pu denote the state 
defined by 

PU (A) = p(U*AU) (,4 è 21) (15) 

In this case, p and pu are said to be unitarily equivalent. Furthermore, if U is a unitary 
operator in 21 and V is a unitary operator in 25, then 

(iv®p) U0V (A®B) = (w® p)(U*AU ®V*BV) (16) 
= (lüu ® p v ){A® B) (17) 
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for all A e 21 and B £ 23. Thus, the uniqueness of product states (LemmaQ entails 
that (lo (g> p)u®v =oju ® Pv- 

For the following lemma, we will need to make use of the fact that p(p, pjj) — 
|p(£/)| 2 for any pure state p |40 Lemma 2.4]. 

Lemma 2. If po,pi are unitarily equivalent pure states of%, and a is an arbitrary 
state o/23 then: 

p(po ® cr, pi ® a) = p(po,pi) (18) 
p(po®Po,Pi ®Pi) = PÍPo,Pi) 2 (19) 

Proof. Since po an d Pi are unitarily equivalent, there is a unitary operator [/ 6 21 
such that pi = (p )u andp(p ,pi) = |po(^)| 2 - Thus pi <g> a = (p ® 0-)(!7<g>J)> and 
therefore 

p(po ® o-, pi ® o-) = \{p ® a){U ® í)\ 2 = \p (U)\ 2 = p(p ,Pi) (20) 
Similarly, p ® po = (pi ® /0i)(t7®t/)> an d therefore 

p(po®Po,Pi®Pi) = |(po«)po)(C/«)i7)| 2 = \po(U)\ 4 = p{po,Pi) 2 (21) 

□ 

Lemma 3. Suppose that 21 and 23 are kinematically independent. If p is a state of 
21 V 23 such that p|g[ is pure or p|sg is pure, then p is a product state. 

Proof. Let lo — p|^, and let B be an effect in 23. Define positive linear functionals Ai 
and A2 on 21 by setting 

Ai(A) = p{B 1 / 2 AB 1 / 2 ) = p(AB) (22) 
X 2 (A) = p{{I-B) l l 2 A{I-Bfl 2 ) = p(A(I-B)) (23) 

for all A € 21. It then follows that 

w(i4) = p(A) = A 1 (A) + A 2 (A) > Ai(A) (24) 
Since lo is a pure state of 21, Ai is a nonnegative múltiple fcw of lo, and 

fc = fcw(J) = Ai(I) = p(5) (25) 

Accordingly, 

p(AB) = Ai(A) = koj(A) = uj{A)p{B) (26) 

By linearity, the same equation holds when we replace B by an arbitrary element of 23. 
Therefore, p{AB) = uj(A)p(B) = p(A)p{B) for all A G 21 and B e 23. □ 
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The proof of the next theorem turns on the fact that nonselective operations cannot 
increase the norm distance between states, and therefore cannot decrease the transition 
probabilities between states. That is, for any nonselective operation T, 

p(T*uj,T*p) > p(u,p) (27) 

for all states u>, p. To see this, note that 

\\T*u-T*p\\ - su P {\(lo-p)(T(A))\ : \\A\\<1} (28) 

and the Russo-Dye theorem entails that if \\A\\ < 1 then \\T(A) || < 1. 

Theorem 3. Iffor each pair {po, Pi} of states of% there is an operation T on 21 V 05 
that broadcasts {po, Pi}> then 21 is abelian. 

Proof. We assume that for each pair {po, pi} of states of 21, there is an operation T 
on 21 V 05 that broadcasts {po, pi}- Suppose for reductio ad absurdum that 21 is not 
abelian. Then there are pure states po,pi of 21 such that < ||po — pi\\ < 2 ll30l 
Exercise 4.6.26]. In this case, pç, and p\ are unitarily equivalent 1 30 Corollary 10.3.8]. 
By hypothesis, there is a Standard state a of 05 and an operation T on 21 V 05 such that 

T*{ Pü ®o-)\ % = T*{ Po ®a)\^ = po (29) 
T*(pi®o-)| a = T*(pi <8) cr)|$g = pi (30) 

Since po and p\ are pure, it follows from Lemma|3]that T*(po ® a) — po ® po and 

T*(px ®a) = p x ® pi- Thus, 

PÍPo,Pi) = p(po®o-,p 1 ®(j) (31) 

< p(T*(p Q ®a),T*( Pl ®<j)) (32) 

= p(po <8> po,Pi ® Pi) (33) 

= PÍPo,Pi) 2 (34) 

(The equalities in Equations[^and[34]follow from Lemma|2] while the inequality in 
Eauation 1321 follows from the fact that transition probabilities cannot decrease under 
T* .) However, the inequality p(po,pi) < p(po,pi) 2 contradicts the fact that < 
p(po, pi) < 1- Therefore, 21 is abelian. □ 

3.4 No Bit Commitment and Nonlocality 

We show that the impossibility of unconditionally secure bit commitment between sys- 
tems A and B, in the presence of the kinematic independence and noncommutativity of 
their algebras of observables, entails nonlocality: spacelike separated systems must at 
least sometimes occupy entangled states. Specifically, we show that if Alice and Bob 
have spacelike separated quantum systems, but cannot prepare any entangled state, then 
Alice and Bob can devise an unconditionally secure bit commitment protocol. 

We first show that quantum systems are characterized by the existence of non- 
uniquely decomposable mixed states. 
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Lcmma 4. Let 21 be a C* -àlgebra. Then 21 is nonabelian if and only if there are 
distinct pure states u>i t 2 an d u>± o/2l such that (1/2) (cjj + u>2) = (l/2)(cj-|_ + cj_). 

Proof. If 21 is abelian then its states are in one-to-one correspondence with measures 
on its pure state space. In particular, if p — (l/2)(o;i + u>2), where U)\,íü2 are distinct 
pure states, then this decomposition is unique. 

Conversely, suppose that there are A, B £ 21 such that [A, B] ^ (cf. |8 Example 
4.2.6]) . Then there is a pure state p of 21 such that p{[A, B\) ^ |30 Thm. 4.3.8]. Let 
(tt, H, Í2) be the GNS representation of 21 induced by p. The dimension of the Hilbert 
space H must exceed one; for otherwise 

tt([A,B}) = [tt(A),tt(B)}=0 (35) 

in contradiction with the fact that (Q, tt([A, B])ü) = p([A, B]) ^ 0. Thus, there is a 
pair xi, X2 of orthogonal unit vectors in Tí. Define two states u>i of 21 by setting 

Ui(A) = {x h ir(A) Xi ) (AeSQ (36) 

Similarly, define, in the same way, another pair of states lo± of 21 using the orthogonal 
unit vectors 2~ 1 / 2 (a; 1 ia^)- Since p is pure, (tt, 7í, Í2) is irreducible, and all four of the 
states Wi 2 and ui± are pure and distinct. Moreover,by construction (1/2)(lü 1 + lü 2 ) — 
(l/2)(w++£J_). ' ' □ 

If each of A and B has a non-uniquely decomposable mixed state, then A+B has 
a pair {po, pi} of distinct (classically) correlated states whose marginals relative to A 
and B are identical. In particular, let 

PO = (1/2) (Wl íg> Ul +UJ2 ®W2) (37) 

pi = (1/2) (<jj + ® lü + + w_ ® w_) (38) 

The protocol then proceeds as follows: Alice and Bob arrange things so that at the 
commitment stage, Alice can make a choice that will determine that either p Q or pi 
is prepared as a suitably long sequence of pure states (u>i, u>2 or w+, the former 
corresponding to the commitment 0, and the latter corresponding to the commitment 1. 
Alice and Bob also agree that at the revelation stage, if Alice committed to then she 
will instruct Bob to perform a measurement that will distinguish between states ui\ and 
u>2, and if she committed to 1 then she will instruct Bob to perform a measurement 
that will distinguish between states cj+ and We must be cautious on this last 
point: neither Alice nor Bob will typically be able to perform a measurement that can 
discriminate with certainty between these states. However, for any e > 0, there is an 
effect A £ 21 such that u>± (A) > 1 — e and u>2 (A) < e. Similarly, there is an effect 
B £ 21 such that uj + (B) > 1 — e and a>_ (B) < e. That is, Alice and Bob can perform 
measurements that will discriminate with arbitrary accuracy between u>i and lú 2 , or 
between u + and cj_ . Finally, Alice will verify her commitment by performing the 
corresponding measurement on her system and reporting the outcomes to Bob. 

Our final theorem shows that if Alice and Bob have access only to classically cor- 
related states (i.e., convex combinations of product states), then this bit commitment 
protocol is secure. In particular, we show that Alice cannot cheat by preparing some 
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state cr which she could later transform at will into either po or pi . To be precise, the 
no superluminal information transfer by measurement constraint entails that Alice can 
perform an operation T on 21 V 25 only if T(B) = B for all BeíB, and T(A) e 21 for 
all A £ 21. It follows then that Alice can transform product states only to other product 
states. 

Theorem 4. If$l and 03 are nonabelian then there is a pair {po, pi} of states q/2lV 03 
such that: 

1- Po|<8 = Pi|q3- 

2. There is no classically correlated state a of 21 V 23 and operations Tq and T± 
performable by Alice such that TqU = po and T^a = p\. 

For the proof of this theorem, we recali that two representations (ir, Tí) and (4>, K.) 
of a C* -àlgebra are said to be quasi-equivalent just in case there is a * isomorphism 
a from 7r(2t)" onto 0(21)" such that a(ir(A)) = <f>(A) for each A in 21. Similarly, 
states ui and p of 21 are said to be quasi-equivalent just in case their corresponding 
GNS representations are quasi-equivalent. Finally, quasi-equivalence is an equivalence 
relation, and is closed under finite convex combinations. 

Proof. Let po and p\ be the states defined in Eans. l37land 1381 Suppose that a = 
S™=i ^ { a i®Pi), where the ai are states of 21, and the /3j are states of 03. Let Tq and Ti 
be operations of 21 V 03 that can be performed by Alice. Then for each i 6 [1 , n] , there 
are states a[ and a" of 21 such that T^(a t ® f3A = a[® Pi and T£(a>i (g> fa) = a" ® fa. 
Moreover, since T * and T* are affine, 



Let /udenote the mixed state (1/2) (üji+lü 2 ) — (1/2)(cj + +w_) of 03. Then Aj/?i = 
p, so that each fa is quasi-equivalent to p. Let (7r, 7i) be the representation of 03 defined 
in Lemma|4] let P\ denote the projection onto x\, and let P + denote the projection onto 
2 _1 / 2 (xi + x-i). (Note that since wi,2, u± are represented by vectors in Ti, it follows 
that (ir, Ti) is unitarily equivalent to the GNS representations induced by these states. 
Moreover, (ir, Tí) is quasi-equivalent to the GNS representation induced by Pi.) Since 
7r(03) is weakly dense in B(7"í), there are nets {Ai} Ç 03 and {Bi} Ç 03 such that 
it(Aí) converges ultraweakly to Pi and ir(Bi) converges ultraweakly to P + . (More- 
over, we can choose these nets so that < ir(Ai), ir(Bi) < I for all i.) Since each 
of the states w^a, w± is represented by a vector in Ti, ultraweak continuity of normal 
states entails that: 



n 




(39) 



n 




(40) 



limp^Ai ® (I- A^) = 



(41) 



limpi((7 - Ai) ® Ai) = 



(42) 
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limpo(Bi (8» (J- Bij) = (43) 

i 

limp ((/ = (44) 

Furthermore, since linii /í(Aí) = 1 /2, there exists some j G [l,n] such that lirn^ /Jj(Aj) > 0. 
Let (3 = /3j and let oi = a^. Then, combining the previous equalities with Eqns.l39l 
andl4*Ulgives: 

lima'(Ai)/3(I - Ai) = (45) 

i 

]ima'(I - Ai)j3(Ai) = (46) 

i 

]ima"(Bi)p(I-Bi) = (47) 

i 

]ïmot"(I -Bí)/3(Bí) = (48) 

i 

Since < /3(Ai),a'(Ai) < 1 for all i, it follows that {(3(Ai)} and {a'(Aj)} have ac- 
cumulation points. Thus, we may pass to a subnet in which lim, /3(Aj) and lirn^ a'(Ai) 
exist (and the preceding equations still hold). We now claim that lini; (3(Ai) — 1. In- 
deed, since lim, a(I - Aí)/3(Aí) = 0, if lim í /?(A 1 ) > then 1 - lim, c/(A;) = 
linij a'(I - Ai) = 0. Moreover, since Urna' (Ai)(3(I - Aï) = 0, it follows that that 
1 — lira; (3 (Ai) = lirrij /3(J — Aí) = 0. Thus linii (3(Ai) = 1. An analogous argument 
shows that either linii (3(Bi) = or limi (3(Bi) = 1. 

Now, since the GNS representation induced by /3 is quasi-equivalent to the irre- 
ducible representation (tt,TÍ), there is a density operator D onTÍ such that = 
Tï(DX) for all £ 03. Since density operator states are ultraweakly continuous, 

Tr(£>Pi) = limTr(L>A) = 1, (49) 

i 

and therefore D = P\. Thus, if lim^ (3(Bí) = then we have a contradiction: 

1/2 = Tr(PiP+) = Tr(L>P + ) = limTr(Z>Pi) = 0. (50) 

But lirrii (3(Bi) = 1 would also result in the contradiction 1/2 = 1. Therefore, there is 
no classically correlated state a such that T *ct = po and T*(T = p\. □ 

It follows that the impossibility of unconditionally secure bit commitment entails 
that if each of a pair of separated physical systems A and B has a non-uniquely decom- 
posable mixed state, so that A+B has a pair {po, pi} of distinct classically correlated 
states whose marginals relative to A and B are identical (as in (I37> and (138» . then A 
and B must be able to occupy an entangled state that can be transformed to po or p\ at 
will by a local operation. The converse result remains open: it is not known whether 
nonlocality — the fact that spacelike separated systems occupy entangled states — entails 
the impossibility of unconditionally secure bit commitment. As we indicated in the in- 
troduction, the proof of the corresponding result in elementary quantum mechanics (in 
which all algebras are type I von Neumann factors) depends on the biorthogonal de- 
composition theorem, via the theorem of Hughston, Jozsa, and Wootters |28|. Thus, 
proving the converse would amount to generalizing the Hughston-Jozsa-Wootters re- 
sult to arbitrary nonabelian C*-algebras. If, as we believe, the more general result 
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holds, then quantum theory can be characterized in terms of our three information- 
theoretic constraints. So, either quantum theory can be characterized in terms of our 
information-theoretic constraints, or there are physical systems which permit an un- 
conditionally secure bit commitment protocol. 

4 Concluding Remarks 

Within the framework of a class of theories broad enough to include both classical and 
quantum particle and field theories, and hybrids of these theories, we have shown that 
three information-theoretic constraints suffice to exclude the classical theories. Specif- 
ically, the information-theoretic constraints entail that the algebras of observables of 
distinct physical systems commute, that the àlgebra of observables of each individ- 
ual system is noncommutative, and that spacelike separated systems occupy entangled 
states. 

Conversely, from the three physical characteristics of a quantum theory in the most 
general sense — kinematic independence, noncommutativity, and nonlocality — we have 
derived two of the three information-theoretic constraints: the impossibility of superlu- 
minal information transfer between two physical systems by performing measure ments 
on one of them, and the impossibility of perfectly broadcasting the information con- 
tained in an unknown physical state. 

It remains an open question whether the third information-theoretic constraint — the 
impossibility of unconditionally secure bit commitment — can be derived as well. As 
we indicated above, this would involve something equivalent to an algebraic general- 
ization of the Hughston-Jozsa-Wootters theorem 1 28 1 to cover cases of systems with an 
infinite number of degrees of freedom that arise in quantum field theory and the thermo- 
dynamic limit of quantum statistical mechanics (in which the number of microsystems 
and the volume they occupy goes to infinity, while the density defined by their ratio 
remains constant). The Stone-von Neumann theorem, which guarantees the existence 
of a unique representation (up to unitary equivalence) of the canonical commutation 
relations for systems with a finite number of degrees of freedom, breaks down for such 
cases, and there will be many unitarily inequivalent representations of the canonical 
commutation relations. 

Since we intend our characterization of quantum theory to apply quite generally to 
these cases as well (including the quantum theoretical description of exòtic phenomena 
such as Hawking radiation, black hole evaporation, Hawking information loss, etc), we 
do not restrict the notion of a quantum theory to the Standard quantum mechanics of a 
system represented on a single Hilbert space with a unitary dynamics. So it would not 
be an appropriate goal of our characterization project to derive the Schròdinger equa- 
tion as a description of the dynamics of a quantum system from information-theoretic 
assumptions. A unitary dynamics will not be implementable in a quantum field theory 
on a curved space-time, for example, which might be a preliminary semi-classical step 
towards a quantum theory of gravity (see Arageorgis et al |2|). 

The foundational significance of our derivation, as we see it, is that quantum me- 
chanics should be interpreted as a principle theory, where the principies at issue are 
information-theoretic. The distinction between principle and constructive theories is 
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introduced by Einstein in his discussion of the significance of the transition from New- 
tonian to relativistic physics 1181 . As Einstein puts it, most theories in physics are 
constructive, with the aim of representing complex phenomena as constructed out of 
the elements of a simple formal scheme. So, for example, the kinetic theory of gases is 
a constructive theory of thermal and diffusion processes in terms of the movement of 
molècules. By contrast 1181 p. 228], principle theories begin with empirically discov- 
ered 'general characteristics of natural processes, principies that give rise to mathemati- 
cally formulated criteria which the separate processes or the theoretical representations 
of them have to satisfy.' Einstein cites thermodynamics as the paradigm example of a 
principle theory. The methodology here is analytic, not synthetic, with the aim of de- 
ducing 1181 p. 228] 'necessary conditions, which separate events have to satisfy, from 
the universally experienced fact that perpetual motion is impossible.' 

Einstein's point is that the theory of relativity is to be understood as a principle 
theory. In the case of the special theory, there are two relevant principies: the equiva- 
lence of inertial frames for all physical laws (the laws of electromagnètic phenomena 
as well as the laws of mechanics), and the constancy of the velocity of light in vacuo 
for all inertial frames. These principies are irreconcilable in the Euclidean geometry of 
Newtonian space-time, where inertial frames are related by Galilean transformations. 
The required revision yields the special theory of relativity and Minkowski geometry, 
in which inertial frames are related by Lorentz transformations. In his Autobiograph- 
ical Notes' ||2ÜI p. 57], Einstein characterizes the special principle of relativity, that 
the laws of physics are invariant with respect to Lorentz transformations from one 
inertial system to another, as 'a restricting principle for natural laws, comparable to 
the restricting principle of the non-existence of the perpetuum mobile which underlies 
thermodynamics.' In the case of the general theory of relativity, the group of allowable 
transformations includes all differentiable transformations of the space-time manifold 
onto itself. 

A relativistic theory is a theory with certain symmetry or invariance properties, de- 
fined in terms of a group of space-time transformations. Following Einstein we under- 
stand this invariance to be a consequence of the fact that we live in a world in which nat- 
ural processes are subject to certain constraints. A quantum theory is a theory in which 
the observables and states have a certain characteristic algebraic structure. Unlike rela- 
tivity theory, quantum mechanics was born as a recipe or algorithm for calculating the 
expectation vàlues of observables measured by macroscopic measuring instruments. 
These expectation vàlues (or probabilities of ranges of vàlues of observables) cannot 
be reduced to probability distributions over the vàlues of dynamical variables (or prob- 
ability distributions over properties of the system). Analogously, one might imagine 
that the special theory of relativity was first formulated geometrically by Minkowski 
rather than Einstein, as an algorithm for relativistic kinematics and the Lorentz trans- 
formation, which is incompatible with the kinematics of Newtonian space-time. What 
differentiates the two cases is that Einstein's derivation provides an interpretation for 
relativity theory: a description of the conditions under which the theory would be true, 
in terms of certain principies that constrain the law-like behavior of physical systems. 
It is in this sense that our derivation of quantum theory from information-theoretic prin- 
cipies can be understood as an interpretation of quantum theory: the theory can now be 
seen as reflecting the constraints imposed on the theoretical representations of physical 
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processes by these principies. 
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